Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called.

I would like to know how this is working and, what are the technique to prevent an UPX packed executable to be decompressed through upx -d (if possible for, both, Linux and Windows).

share|improve this question
    
Of course @blabb's answer prevents upx -d but you should be aware that Generic Unpackers such as RL Depacker can still unpack such files. –  Extreme Coders Feb 8 at 7:45
add comment

2 Answers 2

up vote 7 down vote accepted

UPX doesn't check the unpacking stub's integrity, and just blindly restores the data from the stored information, not from the actual execution.

Since UPX is open-source and documented (commented IDB), it's easy to modify its and actually do something extra (anti-debug, patch, decryption, jump to real entrypoint...) that will be lost when 'upx -d' is used.

Such UPX hack is not uncommon in malware.

share|improve this answer
    
If I get it right, it only requires to modify the checksum of the packed executable... Or did I misunderstood something ? –  perror Dec 30 '13 at 13:47
add comment

Fooling upx -d can be as simple as one byte patch here is a small sample.

Pack the MS-Windows standard calc.exe, hexedit one byte and result is an undepackable executable with upx -d (this is not corrupting the exe, the exe will run and can be unpacked manually). Only unpacking with the -d switch wont work.

  1. create a new folder foolupx:

    foolupx:\>md foolupx
    
  2. copy calc.exe to the newly created folder:

    foolupx:\>copy c:\WINDOWS\system32\calc.exe foolupx\upxedcalc.exe
        1 file(s) copied.
    
  3. pack the renamed calc.exe:

    foolupx:\>upx .\foolupx\upxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
    
        File size         Ratio      Format      Name
       --------------------   ------   -----------   -----------
         114688 ->     56832   49.55%    win32/pe     upxedcalc.exe
    
    Packed 1 file.
    
  4. Create a duplicate of the packed calc.exe for hexediting and compare the files. The difference is 1 byte in the PE header section named UPX0 chained to BPX0:

    foolupx:\>copy .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe
        1 file(s) copied.
    
    foolupx:\>fc .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe
    Comparing files .\FOOLUPX\upxedcalc.exe and .\FOOLUPX\MODUPXEDCALC.EXE
    000001E8: 55 42
    
  5. Uncompress both files with the -d switch. One will be unpacked, the other will not be unpacked:

    foolupx:\>upx -d .\foolupx\modupxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
    
        File size         Ratio      Format      Name
       --------------------   ------   -----------   -----------
        upx: .\foolupx\modupxedcalc.exe: CantUnpackException: file is modified/hacked/protected; take care!!!
    
    Unpacked 0 files.
    
    foolupx:\>upx -d .\foolupx\upxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
    
          File size         Ratio      Format      Name
     --------------------   ------   -----------   -----------
     114688 <-     56832   49.55%    win32/pe     upxedcalc.exe
    
    Unpacked 1 file.
    
    foolupx:\>
    
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.